Registered letter with
acknowledgement of receipt
AR ref. no:
Presidents
Germany
Investigation of the case:
Paris, September 11th 2023
LfDI Baden-Württemberg ref.:
CNIL ref.:
Referral no.
(to be quoted in all correspondence)
Dear Presidents,
I am writing in response to the exchanges of letters between the departments of the German data protection authority of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg) (hereinafter "German authority") and GmbH, as part of the investigation of Mr 's complaint. This complaint was received by the French data protection authority (CNIL) and forwarded to the German authority pursuant to the mechanism on cooperation between European authorities (articles 56 et seq. of the General Data Protection Regulation (GDPR)).
As a reminder, Mr (hereinafter "the complainant") filed a complaint concerning the difficulties encountered in obtaining the erasure of all personal data concerning him processed by your company, including in particular his "bank details, addresses, copy of [... his] identity document" and a "police report". He stated that he sent a request to this effect, on 31 July 2019, and that the latter was not properly processed.
As part of the investigation of this complaint, the German authority noted several elements, including the fact that:
- the company asked the complainant to provide it with a police report to prove the theft of a watch that he had placed online on the company's website;
- the complainant sent this report on 31 July 2019, accompanied by a request to erase all of his personal data held by the company;
- on 1 August 2019, the company erased the data concerned and informed the complainant the following day;
- following this initial information, several emails were exchanged between the departments of GmbH and the complainant, the latter wanting to obtain evidence that his data had been erased;
- written confirmation of the erasure of his data was sent to the complainant by the company on 14 August, then on 19 August 2019.
In addition, the German authority states that it has obtained, from [REDACTED] GmbH, a copy of the emails exchanged between the company and the complainant, including a copy of the letter confirming the erasure of personal data sent to the complainant, and proof that the data has been erased (screenshot showing that the complainant's user account has been deleted).
As such, it emerges from the investigations carried out by the German authority that a response was provided to the complainant's request for erasure and that his data was erased by the company within the time limits and under the conditions provided for by the GDPR.
**In view of these elements, and the fact that [REDACTED] GmbH responded to the complainant's request for erasure in accordance with the provisions of article 17 of the GDPR, I inform you that, in agreement with the European data protection authorities, Mr [REDACTED]'s complaint is rejected.**
However, I would like to add that the German authority notes that there were several exchanges with the company for the purpose of it sending all the documents necessary to assess whether the erasure request has been complied with, and emphasises that the transmission of exchanges that took place between a data controller and the data subject on a request for erasure is not sufficient to constitute proof of the erasure of personal data to the data protection authority.
In addition, in a letter dated 1 March 2022, the company argued that *"proof of the non-existence of the data is naturally difficult to provide"*. However, this statement must be called into question, as I remind you that the data controller must be able to demonstrate compliance with personal data processing principles, in accordance with the liability principle set out in article 5.2 of the GDPR.
In this respect and in this specific case, the data controller may in particular provide a screenshot showing a negative result, i.e. highlighting that the database no longer contains the personal data of the data subject requesting erasure, or that the user cannot be found and has been deleted.
Subject to applicants' interest in bringing proceedings, the CNIL's decisions may be appealed before the French Council of State (Conseil d'État) within two months of their notification.
Yours sincerely,
For the CNIL Chair and on her behalf,
